Re: [syzbot] [hfs?] memory leak in hfs_init_fs_context

[syzbot <syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com>]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

roller area network core
[    9.749562][    T1] NET: Registered PF_CAN protocol family
[    9.750438][    T1] can: raw protocol
[    9.750982][    T1] can: broadcast manager protocol
[    9.751738][    T1] can: netlink gateway - max_hops=1
[    9.752496][    T1] can: SAE J1939
[    9.753010][    T1] can: isotp protocol (max_pdu_size 8300)
[    9.754130][    T1] Bluetooth: RFCOMM TTY layer initialized
[    9.754932][    T1] Bluetooth: RFCOMM socket layer initialized
[    9.755826][    T1] Bluetooth: RFCOMM ver 1.11
[    9.756640][    T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    9.757547][    T1] Bluetooth: BNEP filters: protocol multicast
[    9.758499][    T1] Bluetooth: BNEP socket layer initialized
[    9.759429][    T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[    9.760557][    T1] Bluetooth: HIDP socket layer initialized
[    9.762424][    T1] NET: Registered PF_RXRPC protocol family
[    9.763241][    T1] Key type rxrpc registered
[    9.764425][    T1] Key type rxrpc_s registered
[    9.765548][    T1] NET: Registered PF_KCM protocol family
[    9.766688][    T1] lec:lane_module_init: lec.c: initialized
[    9.767737][    T1] mpoa:atm_mpoa_init: mpc.c: initialized
[    9.768664][    T1] l2tp_core: L2TP core driver, V2.0
[    9.769494][    T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[    9.770289][    T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[    9.771155][    T1] l2tp_netlink: L2TP netlink interface
[    9.771938][    T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[    9.772847][    T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[    9.774041][    T1] NET: Registered PF_PHONET protocol family
[    9.774894][    T1] 8021q: 802.1Q VLAN Support v1.8
[    9.775717][    T1] sctp: Hash tables configured (bind 256/256)
[    9.777068][    T1] NET: Registered PF_RDS protocol family
[    9.778075][    T1] Registered RDS/infiniband transport
[    9.778994][    T1] Registered RDS/tcp transport
[    9.779692][    T1] tipc: Activated (version 2.0.0)
[    9.780699][    T1] NET: Registered PF_TIPC protocol family
[    9.782344][    T1] tipc: Started in single node mode
[    9.784387][    T1] smc: adding smcd device lo without pnetid
[    9.785913][    T1] NET: Registered PF_SMC protocol family
[    9.787625][    T1] 9pnet: Installing 9P2000 support
[    9.789167][    T1] NET: Registered PF_CAIF protocol family
[    9.791371][    T1] NET: Registered PF_IEEE802154 protocol family
[    9.792806][    T1] Key type dns_resolver registered
[    9.794259][    T1] Key type ceph registered
[    9.795165][    T1] libceph: loaded (mon/osd proto 15/24)
[    9.796573][    T1] batman_adv: B.A.T.M.A.N. advanced 2025.4 (compatibility version 15) loaded
[    9.798385][    T1] openvswitch: Open vSwitch switching datapath
[    9.799992][    T1] NET: Registered PF_VSOCK protocol family
[    9.800986][    T1] mpls_gso: MPLS GSO support
[    9.819559][    T1] IPI shorthand broadcast: enabled
[   10.013424][    T1] sched_clock: Marking stable (9984532893, 23793120)->(10012625265, -4299252)
[   10.021125][    T1] registered taskstats version 1
[   10.025750][    T1] Loading compiled-in X.509 certificates
[   10.058263][    T1] Loaded X.509 cert 'Build time autogenerated kernel key: ea23c8da7267aa5b617cb0954f38b31bf7cab05f'
[   10.088097][    T1] zswap: loaded using pool 842
[   10.089329][    T1] Demotion targets for Node 0: null
[   10.090444][    T1] Demotion targets for Node 1: null
[   10.091182][    T1] kmemleak: Kernel memory leak detector initialized (mem pool available: 15732)
[   10.093020][    T1] Key type .fscrypt registered
[   10.093752][    T1] Key type fscrypt-provisioning registered
[   10.095763][    T1] kAFS: Red Hat AFS client v0.1 registering.
[   10.099093][    T1] Btrfs loaded, assert=on, zoned=yes, fsverity=yes
[   10.100242][    T1] Key type big_key registered
[   10.101201][    T1] Key type encrypted registered
[   10.101898][    T1] AppArmor: AppArmor sha256 policy hashing enabled
[   10.102910][    T1] ima: No TPM chip found, activating TPM-bypass!
[   10.103860][    T1] Loading compiled-in module X.509 certificates
[   10.135501][    T1] Loaded X.509 cert 'Build time autogenerated kernel key: ea23c8da7267aa5b617cb0954f38b31bf7cab05f'
[   10.137680][    T1] ima: Allocated hash algorithm: sha256
[   10.138660][    T1] ima: No architecture policies found
[   10.139629][    T1] evm: Initialising EVM extended attributes:
[   10.140520][    T1] evm: security.selinux (disabled)
[   10.141260][    T1] evm: security.SMACK64 (disabled)
[   10.142032][    T1] evm: security.SMACK64EXEC (disabled)
[   10.142977][    T1] evm: security.SMACK64TRANSMUTE (disabled)
[   10.143870][    T1] evm: security.SMACK64MMAP (disabled)
[   10.144647][    T1] evm: security.apparmor
[   10.145278][    T1] evm: security.ima
[   10.145794][    T1] evm: security.capability
[   10.146417][    T1] evm: HMAC attrs: 0x1
[   10.147566][    T1] PM:   Magic number: 1:78:913
[   10.148733][    T1] tty ptyz9: hash matches
[   10.149389][    T1] tty ptywc: hash matches
[   10.150164][    T1] netconsole: network logging started
[   10.151137][    T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[   10.153632][    T1] rdma_rxe: loaded
[   10.154685][    T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[   10.157212][    T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[   10.159121][    T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[   10.160513][ T3094] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[   10.161920][ T3094] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[   10.163450][    T1] clk: Disabling unused clocks
[   10.164221][    T1] ALSA device list:
[   10.164750][    T1]   #0: Dummy 1
[   10.165239][    T1]   #1: Loopback 1
[   10.165745][    T1]   #2: Virtual MIDI Card 1
[   10.167530][    T1] check access for rdinit=/init failed: -2, ignoring
[   10.168530][    T1] md: Waiting for all devices to be available before autodetect
[   10.169637][    T1] md: If you don't use raid, use raid=noautodetect
[   10.170520][    T1] md: Autodetecting RAID arrays.
[   10.171192][    T1] md: autorun ...
[   10.171746][    T1] md: ... autorun DONE.
[   10.355755][    T1] EXT4-fs (sda1): orphan cleanup on readonly fs
[   10.357816][    T1] EXT4-fs (sda1): mounted filesystem 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1 ro with ordered data mode. Quota mode: none.
[   10.359703][    T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[   10.362032][    T1] devtmpfs: mounted
[   10.368420][    T1] Freeing unused kernel image (initmem) memory: 16140K
[   10.370400][    T1] Write protecting the kernel read-only data: 94208k
[   10.374836][    T1] Freeing unused kernel image (text/rodata gap) memory: 1156K
[   10.377014][    T1] Freeing unused kernel image (rodata/data gap) memory: 964K
[   10.479434][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   10.481095][    T1] x86/mm: Checking user space page tables
[   10.573323][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   10.574604][    T1] Failed to set sysctl parameter 'kernel.hung_task_all_cpu_backtrace=1': parameter not found
[   10.578671][    T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[   10.580258][    T1] Run /sbin/init as init process
[   10.915515][ T5147] mount (5147) used greatest stack depth: 12376 bytes left
[   10.959767][ T5148] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1 r/w.
[   10.962072][ T5148] mount (5148) used greatest stack depth: 11720 bytes left
mount: mounting devtmpfs on /dev failed: Device or resource busy
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[   11.009468][ T5152] mount (5152) used greatest stack depth: 10488 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [   11.409279][ T5182] udevd[5182]: starting version 3.2.14
[   11.616899][ T5183] udevd[5183]: starting eudev-3.2.14
[   11.618261][ T5182] udevd (5182) used greatest stack depth: 9464 bytes left
done
Starting system message bus: done
Starting iptables: OK
Starting network: OK
Starting dhcpcd...
dhcpcd-10.2.0 starting
dev: loaded udev
no interfaces have a carrier
[   16.257231][ T5478] 8021q: adding VLAN 0 to HW filter on device bond0
[   16.264394][ T5549] Oops: general protection fault, probably for non-canonical address 0x6564752f62696c4f: 0000 [#1] SMP PTI
[   16.265069][ T5478] eql: remember to turn off Van-Jacobson compression on your slave devices
[   16.275854][ T5549] CPU: 1 UID: 0 PID: 5549 Comm: rcS Not tainted syzkaller #0 PREEMPT(full) 
[   16.275872][ T5549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[   16.275881][ T5549] RIP: 0010:tomoyo_get_name+0xa9/0x270
[   16.308751][ T5549] Code: 0f 85 6a 01 00 00 e8 b6 b1 ec fe 89 d8 48 c1 e3 04 48 8b 9b c0 1a 85 89 48 89 04 24 49 39 dd 0f 84 b2 00 00 00 e8 97 b1 ec fe <44> 8b 7b 20 89 ee 44 89 ff e8 39 a9 ec fe 41 39 ef 0f 85 85 00 00
[   16.328351][ T5549] RSP: 0018:ffffc90002807c28 EFLAGS: 00010293
[   16.334412][ T5549] RAX: 0000000000000000 RBX: 6564752f62696c2f RCX: ffffffff8274e487
[   16.342387][ T5549] RDX: ffff888102fdb480 RSI: ffffffff8274e479 RDI: 0000000000000004
[   16.350405][ T5549] RBP: 000000000367e4aa R08: 0000000000000004 R09: 0000000061736c61
[   16.358373][ T5549] R10: 000000000367e4aa R11: 0000000000000000 R12: ffff88810984c000
[   16.366511][ T5549] R13: ffffffff898520c0 R14: 0000000000000038 R15: 0000000061736c61
[   16.374647][ T5549] FS:  00007fdabe210c80(0000) GS:ffff8881b26c2000(0000) knlGS:0000000000000000
[   16.383729][ T5549] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   16.390297][ T5549] CR2: 00007fec51a9a7b8 CR3: 000000010966c000 CR4: 00000000003526f0
[   16.398302][ T5549] Call Trace:
[   16.401564][ T5549]  <TASK>
[   16.404607][ T5549]  ? tomoyo_assign_namespace+0x84/0x1d0
[   16.410156][ T5549]  tomoyo_assign_domain+0x249/0x490
[   16.415496][ T5549]  tomoyo_find_next_domain+0x4d1/0xdb0
[   16.420969][ T5549]  tomoyo_bprm_check_security+0x72/0xc0
[   16.426508][ T5549]  security_bprm_check+0x1b9/0x1e0
[   16.431605][ T5549]  bprm_execve+0x381/0x830
[   16.436100][ T5549]  do_execveat_common.isra.0+0x262/0x2e0
[   16.441713][ T5549]  __x64_sys_execve+0x3d/0x50
[   16.446381][ T5549]  do_syscall_64+0xa4/0xfa0
[   16.450879][ T5549]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   16.456743][ T5549] RIP: 0033:0x7fdabe3ab107
[   16.461148][ T5549] Code: 0f 00 64 c7 00 07 00 00 00 b8 ff ff ff ff c9 c3 0f 1f 00 48 8b 05 a9 ee 0f 00 48 8b 10 e9 01 00 00 00 90 b8 3b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c1 ec 0f 00 f7 d8 64 89 01 48
[   16.480773][ T5549] RSP: 002b:00007fffd1b40b78 EFLAGS: 00000206 ORIG_RAX: 000000000000003b
[   16.489522][ T5549] RAX: ffffffffffffffda RBX: 000055ca63b60d30 RCX: 00007fdabe3ab107
[   16.497466][ T5549] RDX: 000055ca63b57bb8 RSI: 000055ca63b60d30 RDI: 000055ca63b60ce8
[   16.505417][ T5549] RBP: 000055ca63b60ce8 R08: 0000000000000000 R09: 0000000000000000
[   16.513806][ T5549] R10: 0000000000000008 R11: 0000000000000206 R12: 000055ca63b57bb8
[   16.521843][ T5549] R13: 00007fdabe570e8b R14: 000055ca63b57bb8 R15: 0000000000000000
[   16.529794][ T5549]  </TASK>
[   16.532798][ T5549] Modules linked in:
[   16.536769][ T5549] ---[ end trace 0000000000000000 ]---
[   16.542535][ T5549] RIP: 0010:tomoyo_get_name+0xa9/0x270
[   16.548074][ T5549] Code: 0f 85 6a 01 00 00 e8 b6 b1 ec fe 89 d8 48 c1 e3 04 48 8b 9b c0 1a 85 89 48 89 04 24 49 39 dd 0f 84 b2 00 00 00 e8 97 b1 ec fe <44> 8b 7b 20 89 ee 44 89 ff e8 39 a9 ec fe 41 39 ef 0f 85 85 00 00
[   16.567885][ T5549] RSP: 0018:ffffc90002807c28 EFLAGS: 00010293
[   16.574145][ T5549] RAX: 0000000000000000 RBX: 6564752f62696c2f RCX: ffffffff8274e487
[   16.582126][ T5549] RDX: ffff888102fdb480 RSI: ffffffff8274e479 RDI: 0000000000000004
[   16.590202][ T5549] RBP: 000000000367e4aa R08: 0000000000000004 R09: 0000000061736c61
[   16.598259][ T5549] R10: 000000000367e4aa R11: 0000000000000000 R12: ffff88810984c000
[   16.606251][ T5549] R13: ffffffff898520c0 R14: 0000000000000038 R15: 0000000061736c61
[   16.614332][ T5549] FS:  00007fdabe210c80(0000) GS:ffff8881b26c2000(0000) knlGS:0000000000000000
[   16.623328][ T5549] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   16.629908][ T5549] CR2: 00007fec51a9a7b8 CR3: 000000010966c000 CR4: 00000000003526f0
[   16.637983][ T5549] Kernel panic - not syncing: Fatal exception
[   16.644472][ T5549] Kernel Offset: disabled
[   16.648952][ T5549] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3937347293=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 4e1406b4def
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"4e1406b4defac0e2a9d9424c70706f79a7750cf3\"
/usr/bin/ld: /tmp/cctPnRU9.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=16bad7cd980000


Tested on:

commit:         6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=11f2b60a580000